diff --git a/nfapi/oai_integration/nfapi_vnf.c b/nfapi/oai_integration/nfapi_vnf.c index 776eecf513..640b5f5e0b 100644 --- a/nfapi/oai_integration/nfapi_vnf.c +++ b/nfapi/oai_integration/nfapi_vnf.c @@ -788,10 +788,15 @@ int phy_rx_indication(struct nfapi_vnf_p7_config *config, nfapi_rx_indication_t UL_RCC_INFO.rx_ind[index] = *ind; - if (ind->rx_indication_body.number_of_pdus > 0) - UL_RCC_INFO.rx_ind[index].rx_indication_body.rx_pdu_list = malloc(sizeof(nfapi_rx_indication_pdu_t)*ind->rx_indication_body.number_of_pdus ); + size_t number_of_pdus = ind->rx_indication_body.number_of_pdus; + assert(number_of_pdus <= NFAPI_RX_IND_MAX_PDU); - for (int i=0; irx_indication_body.number_of_pdus; i++) { + if (number_of_pdus > 0) { + UL_RCC_INFO.rx_ind[index].rx_indication_body.rx_pdu_list = + malloc(sizeof(nfapi_rx_indication_pdu_t) * NFAPI_RX_IND_MAX_PDU); + } + + for (int i=0; irx_indication_body.rx_pdu_list[i]; @@ -804,9 +809,9 @@ int phy_rx_indication(struct nfapi_vnf_p7_config *config, nfapi_rx_indication_t dest_pdu->data = NULL; } - LOG_D(PHY, "%s() NFAPI SFN/SF:%d PDUs:%d [PDU:%d] handle:%d rnti:%04x length:%d offset:%d ul_cqi:%d ta:%d data:%p\n", + LOG_D(PHY, "%s() NFAPI SFN/SF:%d PDUs:%zu [PDU:%d] handle:%d rnti:%04x length:%d offset:%d ul_cqi:%d ta:%d data:%p\n", __FUNCTION__, - NFAPI_SFNSF2DEC(ind->sfn_sf), ind->rx_indication_body.number_of_pdus, i, + NFAPI_SFNSF2DEC(ind->sfn_sf), number_of_pdus, i, dest_pdu->rx_ue_information.handle, dest_pdu->rx_ue_information.rnti, dest_pdu->rx_indication_rel8.length, @@ -822,6 +827,7 @@ int phy_rx_indication(struct nfapi_vnf_p7_config *config, nfapi_rx_indication_t *dest_ind = *ind; dest_ind->rx_indication_body.rx_pdu_list = dest_pdu_list; + assert(ind->rx_indication_body.number_of_pdus <= NFAPI_RX_IND_MAX_PDU); for(int i=0; irx_indication_body.number_of_pdus; i++) { nfapi_rx_indication_pdu_t *dest_pdu = &dest_ind->rx_indication_body.rx_pdu_list[i]; nfapi_rx_indication_pdu_t *src_pdu = &ind->rx_indication_body.rx_pdu_list[i]; diff --git a/nfapi/open-nFAPI/nfapi/src/nfapi_p7.c b/nfapi/open-nFAPI/nfapi/src/nfapi_p7.c index 7fbd509786..aecb52272e 100755 --- a/nfapi/open-nFAPI/nfapi/src/nfapi_p7.c +++ b/nfapi/open-nFAPI/nfapi/src/nfapi_p7.c @@ -2592,6 +2592,7 @@ static uint8_t pack_rx_ulsch_indication_body_value(void *tlv, uint8_t **ppWriteP uint16_t total_number_of_pdus = value->number_of_pdus; //printf("ULSCH:pdus:%d\n", total_number_of_pdus); + assert(total_number_of_pdus <= NFAPI_RX_IND_MAX_PDU); for(i = 0; i < total_number_of_pdus; ++i) { nfapi_rx_indication_pdu_t* pdu = &(value->rx_pdu_list[i]); @@ -2615,6 +2616,7 @@ static uint8_t pack_rx_ulsch_indication_body_value(void *tlv, uint8_t **ppWriteP } // Now update the structure to include the offset + assert(total_number_of_pdus <= NFAPI_RX_IND_MAX_PDU); for(i =0; i < total_number_of_pdus; ++i) { nfapi_rx_indication_pdu_t* pdu = &(value->rx_pdu_list[i]); @@ -2630,6 +2632,7 @@ static uint8_t pack_rx_ulsch_indication_body_value(void *tlv, uint8_t **ppWriteP } // Write out the pdu + assert(total_number_of_pdus <= NFAPI_RX_IND_MAX_PDU); for(i = 0; i < total_number_of_pdus; ++i) { nfapi_rx_indication_pdu_t* pdu = &(value->rx_pdu_list[i]); @@ -2640,6 +2643,7 @@ static uint8_t pack_rx_ulsch_indication_body_value(void *tlv, uint8_t **ppWriteP } // Write out the pdu data + assert(total_number_of_pdus <= NFAPI_RX_IND_MAX_PDU); for(i = 0; i < total_number_of_pdus; ++i) { uint16_t length = 0; @@ -6496,7 +6500,8 @@ static uint8_t unpack_rx_indication_body_value(void *tlv, uint8_t **ppReadPacked if (value->number_of_pdus > 0) { - value->rx_pdu_list = (nfapi_rx_indication_pdu_t *)nfapi_p7_allocate(sizeof(nfapi_rx_indication_pdu_t) * value->number_of_pdus, config); + assert(value->number_of_pdus <= NFAPI_RX_IND_MAX_PDU); + value->rx_pdu_list = (nfapi_rx_indication_pdu_t *)nfapi_p7_allocate(sizeof(nfapi_rx_indication_pdu_t) * NFAPI_RX_IND_MAX_PDU, config); if (value->rx_pdu_list == NULL) { NFAPI_TRACE(NFAPI_TRACE_ERROR, "%s failed to allocate rx ind pdu list (count:%d)\n", __FUNCTION__, value->number_of_pdus); @@ -6529,6 +6534,7 @@ static uint8_t unpack_rx_indication_body_value(void *tlv, uint8_t **ppReadPacked return 0; } + assert(i <= NFAPI_RX_IND_MAX_PDU); nfapi_rx_indication_pdu_t *pdu = &value->rx_pdu_list[i]; pdu->rx_ue_information.tl = generic_tl; @@ -6584,6 +6590,7 @@ static uint8_t unpack_rx_indication_body_value(void *tlv, uint8_t **ppReadPacked } } + assert(value->number_of_pdus <= NFAPI_RX_IND_MAX_PDU); for (int i = 0; i < value->number_of_pdus; ++i) { nfapi_rx_indication_pdu_t *pdu = &value->rx_pdu_list[i]; diff --git a/nfapi/open-nFAPI/vnf/src/vnf_p7.c b/nfapi/open-nFAPI/vnf/src/vnf_p7.c index 1420246fe9..4dacb99b5f 100644 --- a/nfapi/open-nFAPI/vnf/src/vnf_p7.c +++ b/nfapi/open-nFAPI/vnf/src/vnf_p7.c @@ -23,9 +23,14 @@ #include #include #include +#include #include "vnf_p7.h" +#ifdef NDEBUG +# warning assert is disabled +#endif + #define SYNC_CYCLE_COUNT 2 void* vnf_p7_malloc(vnf_p7_t* vnf_p7, size_t size) @@ -818,6 +823,7 @@ void vnf_handle_rx_ulsch_indication(void *pRecvMsg, int recvMsgLen, vnf_p7_t* vn } } + assert(ind.rx_indication_body.number_of_pdus <= NFAPI_RX_IND_MAX_PDU); uint16_t i = 0; for(i = 0; i < ind.rx_indication_body.number_of_pdus; ++i) { @@ -2500,8 +2506,9 @@ void vnf_p7_release_msg(vnf_p7_t* vnf_p7, nfapi_p7_message_header_t* header) case NFAPI_RX_ULSCH_INDICATION: { nfapi_rx_indication_t* rx_ind = (nfapi_rx_indication_t*)(header); - uint16_t i = 0; - for(i = 0; i < rx_ind->rx_indication_body.number_of_pdus; ++i) + size_t number_of_pdus = rx_ind->rx_indication_body.number_of_pdus; + assert(number_of_pdus <= NFAPI_RX_IND_MAX_PDU); + for(size_t i = 0; i < number_of_pdus; ++i) { vnf_p7_codec_free(vnf_p7, rx_ind->rx_indication_body.rx_pdu_list[i].data); } diff --git a/openair1/SCHED/phy_procedures_lte_eNb.c b/openair1/SCHED/phy_procedures_lte_eNb.c index 38307a7b9e..47e8625f8d 100644 --- a/openair1/SCHED/phy_procedures_lte_eNb.c +++ b/openair1/SCHED/phy_procedures_lte_eNb.c @@ -1554,6 +1554,7 @@ void fill_rx_indication(PHY_VARS_eNB *eNB, pthread_mutex_lock(&eNB->UL_INFO_mutex); eNB->UL_INFO.rx_ind.sfn_sf = frame<<4| subframe; eNB->UL_INFO.rx_ind.rx_indication_body.tl.tag = NFAPI_RX_INDICATION_BODY_TAG; + assert(eNB->UL_INFO.rx_ind.rx_indication_body.number_of_pdus <= NFAPI_RX_IND_MAX_PDU); pdu = &eNB->UL_INFO.rx_ind.rx_indication_body.rx_pdu_list[eNB->UL_INFO.rx_ind.rx_indication_body.number_of_pdus]; // pdu->rx_ue_information.handle = eNB->ulsch[UE_id]->handle; pdu->rx_ue_information.tl.tag = NFAPI_RX_UE_INFORMATION_TAG; diff --git a/openair2/PHY_INTERFACE/IF_Module.c b/openair2/PHY_INTERFACE/IF_Module.c index c1f22e9f8d..cc146ec41f 100644 --- a/openair2/PHY_INTERFACE/IF_Module.c +++ b/openair2/PHY_INTERFACE/IF_Module.c @@ -227,6 +227,7 @@ void handle_ulsch(UL_IND_t *UL_info) { } else if(NFAPI_MODE == NFAPI_MODE_VNF) { for(uint8_t k = 0; k < NUM_NFPAI_SUBFRAME; k++) { if((UL_RCC_INFO.rx_ind[k].rx_indication_body.number_of_pdus>0) && (UL_RCC_INFO.crc_ind[k].crc_indication_body.number_of_crcs>0)) { + assert(UL_RCC_INFO.rx_ind[k].rx_indication_body.number_of_pdus <= NFAPI_RX_IND_MAX_PDU); for (i=0; irx_ind.rx_indication_body.number_of_pdus>0 && UL_info->crc_ind.crc_indication_body.number_of_crcs>0) { + assert(UL_info->rx_ind.rx_indication_body.number_of_pdus <= NFAPI_RX_IND_MAX_PDU); for (i=0; irx_ind.rx_indication_body.number_of_pdus; i++) { for (j=0; jcrc_ind.crc_indication_body.number_of_crcs; j++) { // find crc_indication j corresponding rx_indication i diff --git a/openair2/PHY_INTERFACE/phy_stub_UE.c b/openair2/PHY_INTERFACE/phy_stub_UE.c index 5794d74c6d..d7f667c172 100644 --- a/openair2/PHY_INTERFACE/phy_stub_UE.c +++ b/openair2/PHY_INTERFACE/phy_stub_UE.c @@ -87,6 +87,7 @@ void fill_rx_indication_UE_MAC(module_id_t Mod_id, UL_INFO->rx_ind.rx_indication_body.tl.tag = NFAPI_RX_INDICATION_BODY_TAG; UL_INFO->rx_ind.vendor_extension = ul_config_req->vendor_extension; + assert(UL_INFO->rx_ind.rx_indication_body.number_of_pdus <= NFAPI_RX_IND_MAX_PDU); pdu = &UL_INFO->rx_ind.rx_indication_body .rx_pdu_list[UL_INFO->rx_ind.rx_indication_body.number_of_pdus]; // pdu = &UL_INFO->rx_ind.rx_indication_body.rx_pdu_list[index]; @@ -1538,6 +1539,7 @@ static void print_rx_ind(nfapi_rx_indication_t *p) printf("rx_indication_body.tl.length: %u\n", p->rx_indication_body.tl.length); printf("rx_indication_body.number_of_pdus: %u\n", p->rx_indication_body.number_of_pdus); + assert(p->rx_indication_body.number_of_pdus <= NFAPI_RX_IND_MAX_PDU); nfapi_rx_indication_pdu_t *pdu = p->rx_indication_body.rx_pdu_list; for (int i = 0; i < p->rx_indication_body.number_of_pdus; i++) { diff --git a/targets/RT/USER/lte-ue.c b/targets/RT/USER/lte-ue.c index 3eaccb5fa8..f4d04d636c 100644 --- a/targets/RT/USER/lte-ue.c +++ b/targets/RT/USER/lte-ue.c @@ -1040,7 +1040,7 @@ static void *UE_phy_stub_standalone_pnf_task(void *arg) UE = rtd->UE; UL_INFO = (UL_IND_t *)calloc(1, sizeof(UL_IND_t)); - UL_INFO->rx_ind.rx_indication_body.rx_pdu_list = calloc(NUMBER_OF_UE_MAX, sizeof(nfapi_rx_indication_pdu_t)); + UL_INFO->rx_ind.rx_indication_body.rx_pdu_list = calloc(NFAPI_RX_IND_MAX_PDU, sizeof(nfapi_rx_indication_pdu_t)); UL_INFO->rx_ind.rx_indication_body.number_of_pdus = 0; UL_INFO->crc_ind.crc_indication_body.crc_pdu_list = calloc(NUMBER_OF_UE_MAX, sizeof(nfapi_crc_indication_pdu_t)); UL_INFO->crc_ind.crc_indication_body.number_of_crcs = 0; @@ -1281,7 +1281,8 @@ static void *UE_phy_stub_standalone_pnf_task(void *arg) send_standalone_msg(UL_INFO, UL_INFO->rx_ind.header.message_id); sent_any = true; - for (uint8_t num_pdu = 0; num_pdu < UL_INFO->rx_ind.rx_indication_body.number_of_pdus; num_pdu++) { + assert(UL_INFO->rx_ind.rx_indication_body.number_of_pdus <= NFAPI_RX_IND_MAX_PDU); + for (size_t num_pdu = 0; num_pdu < UL_INFO->rx_ind.rx_indication_body.number_of_pdus; num_pdu++) { free(UL_INFO->rx_ind.rx_indication_body.rx_pdu_list[num_pdu].data); }